diff --git a/charts/memberships/templates/install.yaml b/charts/memberships/templates/install.yaml
index aae4bc9..7179d1b 100644
--- a/charts/memberships/templates/install.yaml
+++ b/charts/memberships/templates/install.yaml
@@ -11,7 +11,22 @@
     - name: {{ .Values.portName }}
       protocol: TCP
       port: 80
-      targetPort: {{ .Values.portName }}
+      targetPort: ui
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: memberships-api
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: ClusterIP
+  selector:
+    app: memberships
+  ports:
+    - name: {{ .Values.portName }}
+      protocol: TCP
+      port: 80
+      targetPort: api
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -32,12 +47,16 @@
       - name: memberships
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
         ports:
-        - name: {{ .Values.portName }}
+        - name: ui
           containerPort: 8080
           protocol: TCP
+        - name: api
+          containerPort: 8081
+          protocol: TCP
         command:
         - memberships
         - --port=8080
+        - --api-port=8081
         - --db-path=/data/memberships.db
         volumeMounts:
         - name: memberships
diff --git a/core/auth/memberships/Makefile b/core/auth/memberships/Makefile
index 1defe7d..5959f01 100644
--- a/core/auth/memberships/Makefile
+++ b/core/auth/memberships/Makefile
@@ -7,7 +7,7 @@
 
 
 clean:
-	rm -f memberships*
+	rm -f memberships memberships_*
 
 build: clean
 	/usr/local/go/bin/go build -o memberships *.go
diff --git a/core/auth/memberships/main.go b/core/auth/memberships/main.go
index 0a2bda4..bc8f384 100644
--- a/core/auth/memberships/main.go
+++ b/core/auth/memberships/main.go
@@ -19,7 +19,8 @@
 	"github.com/gorilla/mux"
 )
 
-var port = flag.Int("port", 8080, "ort to listen on")
+var port = flag.Int("port", 8080, "Port to listen on")
+var apiPort = flag.Int("api-port", 8081, "Port to listen on for API requests")
 var dbPath = flag.String("db-path", "memberships.db", "Path to SQLite file")
 
 //go:embed index.html
@@ -477,17 +478,25 @@
 	Member
 )
 
-func (s *Server) Start() {
-	router := mux.NewRouter()
-	router.PathPrefix("/static/").Handler(http.FileServer(http.FS(staticResources)))
-	router.HandleFunc("/group/{group-name}", s.groupHandler)
-	router.HandleFunc("/create-group", s.createGroupHandler)
-	router.HandleFunc("/add-user", s.addUserHandler)
-	router.HandleFunc("/add-child-group", s.addChildGroupHandler)
-	router.HandleFunc("/api/init", s.apiInitHandler)
-	router.HandleFunc("/api/user/{username}", s.apiMemberOfHandler)
-	router.HandleFunc("/", s.homePageHandler)
-	log.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", *port), router))
+func (s *Server) Start() error {
+	e := make(chan error)
+	go func() {
+		r := mux.NewRouter()
+		r.PathPrefix("/static/").Handler(http.FileServer(http.FS(staticResources)))
+		r.HandleFunc("/group/{group-name}", s.groupHandler)
+		r.HandleFunc("/create-group", s.createGroupHandler)
+		r.HandleFunc("/add-user", s.addUserHandler)
+		r.HandleFunc("/add-child-group", s.addChildGroupHandler)
+		r.HandleFunc("/", s.homePageHandler)
+		e <- http.ListenAndServe(fmt.Sprintf(":%d", *port), r)
+	}()
+	go func() {
+		r := mux.NewRouter()
+		r.HandleFunc("/api/init", s.apiInitHandler)
+		r.HandleFunc("/api/user/{username}", s.apiMemberOfHandler)
+		e <- http.ListenAndServe(fmt.Sprintf(":%d", *apiPort), r)
+	}()
+	return <-e
 }
 
 type GroupData struct {
@@ -807,5 +816,5 @@
 		panic(err)
 	}
 	s := Server{store}
-	s.Start()
+	log.Fatal(s.Start())
 }
diff --git a/core/installer/app.go b/core/installer/app.go
index e91174a..8457fe2 100644
--- a/core/installer/app.go
+++ b/core/installer/app.go
@@ -188,7 +188,7 @@
 						upstream: "\(inp.serviceName).\(release.namespace).svc.cluster.local"
 						whoAmIAddr: "https://accounts.\(global.domain)/sessions/whoami"
 						loginAddr: "https://accounts-ui.\(global.domain)/login"
-						membershipAddr: "http://memberships.\(global.id)-core-auth-memberships.svc.cluster.local/api/user"
+						membershipAddr: "http://memberships-api.\(global.id)-core-auth-memberships.svc.cluster.local/api/user"
 						groups: inp.auth.groups
 						portName: _authProxyHTTPPortName
 					}
diff --git a/core/installer/values-tmpl/welcome.cue b/core/installer/values-tmpl/welcome.cue
index f94a77f..725b799 100644
--- a/core/installer/values-tmpl/welcome.cue
+++ b/core/installer/values-tmpl/welcome.cue
@@ -38,7 +38,7 @@
 			sshPrivateKey: base64.Encode(null, input.sshPrivateKey)
 			createAccountAddr: "http://api.\(global.namespacePrefix)core-auth.svc.cluster.local/identities"
 			loginAddr: "https://accounts-ui.\(global.domain)"
-			membershipsInitAddr: "http://memberships.\(global.namespacePrefix)core-auth-memberships.svc.cluster.local/api/init"
+			membershipsInitAddr: "http://memberships-api.\(global.namespacePrefix)core-auth-memberships.svc.cluster.local/api/init"
 			ingress: {
 				className: _ingressPublic
 				domain: "welcome.\(global.domain)"